Overview

overview

10

Static

static

1deec701f0...7c.exe

windows7_x64

10

1deec701f0...7c.exe

windows10-2004_x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    1deec701f0f95e56e1cd7fa7b5722b223f83062093df8def6a0df7f6fa09337c
  • Size 268KB
  • Sample220612-2w7apaefd7
  • SHA256 1deec701f0f95e56e1cd7fa7b5722b223f83062093df8def6a0df7f6fa09337c
  • MD5 SHA1 SHA512
Score
10/10
gootkit410bankerbotnettrojan

Malware Config

Extracted

Family

  • gootkit

Botnet

  • 410

C2

  • parking.dynophyl.com

  • parked.dynonortheast.com

  • trktrk.eu

  • smeinsurances.co.uk

Attributes
  • vendor_id

    410

Targets

    • Target
      1deec701f0f95e56e1cd7fa7b5722b223f83062093df8def6a0df7f6fa09337c
    • Size 268KB
    • SHA256 1deec701f0f95e56e1cd7fa7b5722b223f83062093df8def6a0df7f6fa09337c
    • MD5 SHA1 SHA512
    Score
    10/10
    gootkit410bankerbotnettrojan

    • Gootkit

      Gootkit is a banking trojan, where large parts are written in node.JS.

      trojanbankerbotnetgootkit

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Deletes itself

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks